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Abstract. We give a polynomial time algorithm for computing the Igusa local 
zeta function Z(s,f) attached to a polynomial f(x) £ in one variable, 

with splitting field Q, and a prime number p. We also propose a new class 
of Linear Feedback Shift Registers based on the computation of Igusa's local 
zeta function. 



1. Introduction 

Let f(x) € Z[x], x — (xi, • • -,x n ) be a non-constant polynomial, and p a fixed 
prime number. We put N m (f,p) = N m (f) for the number of solutions of the 
congruence f(x) = mod p m in (Z/p m Z)™, m ^ 1, and if (i, /) for the Poincare 
series 

oo 

H(tJ)= N m {f){p- n t) m , 
m=0 

with t 6 C, 1 1 |< 1, and No(f) = 1. This paper is dedicated to the computation of 
the sequence {N m (f)} m>0 when / is an univariate polynomial with splitting field 

Q. 

Igusa showed that the Poincare series H(t, /) admits a meromorphic continu- 
ation to the complex plane as a rational function of t |l4[ , [ jl5| . In this paper we 
make a first step towards the solution of the following problem: given a polynomial 
f(x) as above, how difficult is to compute the meromorphic continuation of the 
Poincare series H(t, /)? 

The computation of the Poincare series H(t, f) is equivalent to the computation 
of Igusa's local zeta function Z(s, /), attached to / and p, defined as follows. We 
denote by Q p the field of p— adic numbers, and by Z p the ring of p— adic integers. 
For x G Q p , v p (x) denotes the p— adic order of x, and \x\ p = p""" 1 ' its absolute 
value. The Igusa local zeta function associated to / and p is defined as follows: 



Z(s,f) = J Jf(x)\ s p \dx\, seC, 



where Re(s) > 0, and | dx \ denotes the Haar measure on Q™ so normalized that 
Z™ has measure 1. The following relation between Z(s,f) and H(t,f) holds (see 
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111, theorem 8.2.2): 



Thus, the rationality of Z(s, /) implies the rationality of the Poincare series H (t, f), 
and the computation of H (t, /) is equivalent to the computation of Z(s, /). Igusa 
|l4[ theorem 8.2.1] showed that the local zeta function Z(s, /) admits a meromor- 
phic continuation to the complex plane as a rational function of p~ s . 

The first result of this paper is a polynomial time algorithm for computing the 
local zeta function Z(s,f) attached to a polynomial f(x) G Z[x], in one variable, 
with splitting field Q, and a prime number p. We also give an explicit estimate for 



its complexity (see algorithm Compute_Z(s, /) in section 2, and theorem 7.1 ). 

Many authors have found explicit formulas for Z(s, /), or H(f,t), for several 
classes of polynomials, among them ||, 0, [|l(|, [|ll], [Jl6| and the references 



therein], 19 , [|2J], [j25j. In all these works the computation of Z(s, f), or H (/, i), is 
reduced to the computation of other problems, as the computation of the number of 
solutions of polynomial equations with coefficients in a finite field. Currently, there 



is no polynomial time algorithm solving this problem 23 , [|22| . Moreover, none 
of the above mentioned works include complexity estimates for the computation of 
Igusa's local zeta functions. 

Of particular importance is Denef's explicit formula for Z(s, /), when / satisfies 
some generic conditions M. This formula involves the numerical data associated 
to a resolution of singularities of the divisor / = 0, and the number of rational 
points of certain non-singular varieties over finite fields. Thus the computation of 
Z(s,f), for a generic polynomial /, is reduced to the computation of the numer- 
ical data associated to a resolution of singularities of the divisor / = 0, and the 
number of solutions of non-singular polynomials over finite fields. Currently, it is 
unknown if these problems can be solved in polynomial time on a Turing machine. 
However, during the last few years important achievements have been obtained in 
the computation of resolution of singularities of polynomials M, j|, |21 



The computation of the Igusa local zeta function for an arbitrary polynomial 
seems to be an intractable problem on a Turing machine. For example, for p = 2, the 
computation of the number of solutions of a polynomial equation with coefficients 
in Z/2Z is an NP— complete problem on a Turing Machine ^ page 251, problem 
AN9]. Then in the case of 2— adic numbers, the computation of the Igusa local 
zeta function is an NP— complete problem. 

Recently, Anshel and Goldfeld have shown the existence of a strong connection 
between the computation of zeta functions and cryptography (![]. Indeed, they 
proposed a new class of candidates for one-way functions based on global zeta 
functions. A one-way function is a function F such that for each x in the domain 
of F, it is easy to compute F(x); but for essentially all y in the range of F, it is 
an intractable problem to find an x such that y = F(x). These functions play a 
central role, from a practical and theoretical point of view, in modern cryptography. 
Currently, there is no guarantee that one-way functions exist even if P ^ NP. Most 
of the present candidates for one-way functions are constructed on the intractability 
of problems like integer factorization and discrete logarithms |12f . Recently, P. Shor 



has introduced a new approach to attack these problems |20 . Indeed, Shor have 
shown that on a quantum computer the integer factorization and discrete logarithm 
problems can be computed in polynomial time. 
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We set 

H = {H(t, /) | f(x) G Z[x], in one variable, with splitting field Q}, 

and N°° (Z) for the set of finite sequences of integers. For each positive integer u 
and a prime number p 7 we define 

F u , p : H -> N°°(Z) 

H(tJ) -> {N (f,p),N 1 (f,p),--- ,N u (f,p)}. 

Our second result asserts that F u ^ p (H(t, /)) can be computed in polynomial 



time, for every H(t,f) in 7i (see theorem 8.1). It seems interesting to study the 
complexity on a Turing machine of the following problem: given a list of positive 
integers {ao, Oi, • • • , a M }, how difficult is it to determine whether or not there exists 
a Poincare series H(t, f) = J2m=o NmiDip^t)" 1 , such that a. L = N. t (f), i = !,■■■, 
ul 

Currently, the author does not have any result about the complexity of the above 
problem, however the mappings F UtP can be considered as new class of stream 
ciphers (see section 8). 

2. The Algorithm Compute_Z(s, /) 

In this section we present a polynomial time algorithm, Compute_Z(s, /), that 
solves the following problem: given a polynomial f(x) £ Z[ir], in one variable, 
whose splitting field is Q, find an explicit expression for the meromorphic contin- 
uation of Z(s, /). The algorithm is as follows. 

Algorithm Compute_Z(s, /) 

Input : A polynomial f(x) 6 Z[x], in one variable, whose splitting field is Q. 
Output : A rational function of p~ s that is the meromorphic continuation 
oiZ(s,f). 

r 

1. Factorize f(x) in Q[x}: f(x) = a J] {x - a t ) ei € Q[x}. 

i=l 

2. Compute 



If = 



1 + max{w p (ai — aj) \ i ^ j, 1 < i, j < r}, if r ^ 2; 

1, if r = 1. 



Compute the p— adic expansions of the numbers o^, i = 1, 2, • ■ • , r modulo 
Compute the tree T(f,lf) associated to f(x) and p (for the definition of 



T(f,l f ) see (y)). 

5. Compute the generating function G(s , T(f,lf) 7 p) attached to T(f,lf) (for the 
definition of G(s,T(f,lf),p) see ( |5.l|) ). 

6. Return Z(s,f) = G(s,T(f,lf),p). 

7. End 

In section 6, we shall give a proof of the correctness and a complexity estimate 
for the algorithm Compute_2'(s, /). The first step in our algorithm is accomplished 
by means of the factoring algorithm by A.K. Lenstra, H. Lenstra and L. Lovasz 



17|. If df denotes the degree of f(x) = J2i aix\ and 

ii / n= 
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then the mentioned factoring algorithm needs O yd® + dy(log n / n)j arithmetic 
operations, and the integers on which these operations are performed each have a 
binary length O ^c?^ + dj(log n / n)J |l7], theorem 3.6]. 

The steps 2, 3, 4, 5 reduce in polynomial time the computation of Z(s, /) to 
the computation of a factorization of fix) over Q. This reduction is accomplished 
by constructing a weighted tree from the p— adic expansion of the roots of f(x) 
modulo a certain power of p (see section 4), and then associating a generating 
function to this tree (see section 5). Finally, we shall prove that the generating 
function constructed in this way coincides with the local zeta function of f(x) (see 
section 5). 

3. p-adic Stationary Phase Formula 

Our main tool in the effective computing of Igusa's local zeta function of a 
polynomial in one variable will be the p— adic stationary phase formula, abbreviated 
SPF |16|j . This formula is a recursive procedure for computing local zeta functions. 
By using this procedure it is possible to compute the local zeta functions for many 
classes of polynomials []l6) and the references therein], Q, ^4j, |2E|, pq| . 

Given a polynomial f(x) G Z p [x]\ pZ p [x], we denote by fix) its reduction modulo 
pZ p , i.e., the polynomial obtained by reducing the coefficients of f{x) modulo pZ p . 
We define for each xq G Z p , 

Uq(x) =p~ e ^f{x +px), 

where e XQ is the minimum order of p in the coefficients of f(xo + px). Thus 
f Xo {x) € Z p [a:]\ p7L v \x\. We shall call the polynomial f Xo {x) the dilatation of f{x) 
at xq. We also define 

1/(7) = Card{z G ¥ p | J(z) ? 0}, 

^(/) = Card{z G F p | ~z is a simple root of f(z) = 0}. 

We shall use {0, 1, • • • , p— 1} CZ p as a set of representatives of the elements of 
F p = Z/ pZ = {0,T, • • • ,p~T}. Let 5 = S(f) denote the subset of {0, 1, • • • ,p - 
1} C Z p which is mapped bijectively by the canonical homomorphism Z p Zp/pZ p 
to the set of roots of /(z) = with multiplicity greater than or equal to two. 

With all the above notation we are able to state the p— adic stationary phase 
formula for polynomials in one variable. 

Proposition 3.1 ([[l4], theorem 10.2.1]). Let f(x) G Z p [x]\ pZ p [a;] be a non-cons- 
tant polynomial. Then 

Z(s, /) = p-^Q) + 6{J) {1 ~ P ~2Vs7 +Y<P~ l ~ HS [ I ftW \p dx - 

The following example illustrates the use of the p— adic stationary phase formula, 
and also the basic aspects of our algorithm for computing Z(s, /). 
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3.1. Example. Let f(x) = (x — a\)(x — ot2) 3 {x — a^)(x — ai) 2 (x — a^) be a 
polynomial such that a±, ai , 013, 0:4 , ag are integers having the following p— adic 
expansions: 





= a - 


\-dp- 


Ykp 2 


Q 2 


= a - 


f dp- 


Hp 2 , 


a 3 


= b^ 


-gp^ 


- mp 2 


a 4 


= cH 


- hpn 




a 5 


= c - 


h fcp- 


Vrp 2 



where the p-adic digits a, b, c, d, g, h, I, m, n, r belong to {0, 1, • • -,p — 1}. We 
assume the p-adic digits to be different by pairs. The local zeta function Z(s, /) 
will be computed by using SPF iteratively. 

By applying SPF with J(xj = (x -a) 4 (x -b)(x -c) 3 , vQ)=p-Z, 8{j) = 1,S = 
{a, c}, f a {x) — p~ 4 f(a + px), and f c {x) = p~ 3 f(c + px), we obtain that 



Z(sJ) = p- 1 ( P -3) + 



(3.1) 



+P 



-l-3s 



1 -p- 1 - 8 

\fc(x)\; \dx\. 



-l-4s 



\fa(x)\p I dx 



We apply SPF to the integrals involving f a {x) and f c {x) in (3.1). First, we consider 
the integral corresponding to f a {x). Since f a {x) — (x — d) 4 ia — b)(a — c) 3 , S = {d}, 
f a .d( x ) = P~ 4 fa(d + px), v(f a ) =p-l, and 5(f a ) = 0, it follows from (|3~l| ) using 
SPF that 



Z(s,f) 



p- i (p-v+ (i : ^icr +p-\p- ^p- 1 - 4 * 



(3.2) 



+P 



-2-Ss 



1 -p- 1 - 
\fa, d (x)\ S p I dx | +p 



\fc(x)\ S p | dx | 



Now, we apply SPF to the integral involving f c (x) in _(|3.2j ). Since f c (x) — (c — 
a) 4 (c - b)(x - h)\S = {h}, f c . h (x) = P - 3 fc(h + px), v{j c ) = p - 1, and 5{f c ) = 0, 
it follows from (B.2) using SPF that 

z(sj) = p- i ( P -3)+ (i 7 p ~ i) rr' + P - i (p-i)p- 1 ^ 

i — p 1 * 

+^ 2 - 8s / |/a >d (a:)|; I rfx I +p" 1 (p - IK 1 " 35 



(3.3) 



-2-6s 



l/c,/i(z)|p I dz 



By applying SPF to the integral involving f a ,d(x) in (3J5), with f a ,d(x) = (x — 

k)(x-Tf(d-b)(d-c) 3 , S = {k,l}, fa, d ,k{x)=p-^fa, d {k + P x), \fa,d,k(x)\ S p = \x\ S p , 
fa,dd( x ) — P~ 3 fa,d{ 1 +PX), \fa,d,l{ x )\p = \x\ 3s , v{fa,d) = P ~ % and f>(/a,d) = 1, We 

obtain that 
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Z(sJ) = p- 1 (p-3)+ (1 1 g-j^ S +p- 1 {p-l)p- 1 - is 

+ p -hp - ik 1 - 38 + p-\p 2) P - 2 - 8s + (1 : p " 1) f!" 9fl 

i — p 1 s 

(3-4) +P^ 6s [ \fM\ s P \dx\. 

1 ~ P JZv 



Finally, by applying SPF to the integral involving f c> h{%) m (p-4[ ), we obtain that 

1 -p- 1 - 3 



z(«,/) = p- 1 ^ - 3) + v - - i) P - 

,-l\«-3-9s 



- ik 1 - 3 * + p -Hp - 2K 2 - 8 * + (1 *~\ s 

1 — p 1 s 



(3.5) + 



l_p-l-3s ^ ^ ^ l_p-l-s 



l_ p -l-2s 

Remark 3.1. If a = % G Q, and i> p (a) < 0, f/ien 

(3.6) | £ — a p =| a | p , /or ei;erj/ cc S Z p . 
On i/ie other hand, a polynomial of the form 

r 

f{x)=aol[(x-a i ) e * 6Q[i], 

i=l 

can fee decomposed as f(x) = otof—(x)f+(x), where 

(3.7) /_(*) = [] (aJ-Oi) 64 , and /+(*) = ]J {x - a,) e 

{a i | t )p(Q i )<0} {ai|Up(a 4 )^Q} 



From flg.fy ) and ( fg.^ /o/Zou; that 

Z(s,f)=\a J] 

{aiMa,)<0} 

Thus, from a computational point of view, we may assume without loss of generality 
that all roots of f[x) arep—adic integers. 

4. Trees and p-adic Numbers 

The tree U — U(p) of residue classes modulo powers of a given prime number p 
is defined as follows. Consider the diagram 

{0} = Z/p°Z ( 0! Z/p x Z ^2 %/p 2 % h. • • ' 

where 0; the are the natural homomorphisms. The vertices of U are the elements 
of Z/p'Z, for Z = 0, 1, 2, • • •, and the directed edges are u — > u where it e Z/p'Z 
and 0;(n) = u, for some I > 0. Thus J7 is a rooted tree with root {0}. Exactly one 
directed edge emanates from each vertex of U] except from the vertex {0}, from 
which no edge emanates. In addition, every vertex is the end point of exactly p 
directed edges. 
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Given two vertices u, v the notation u > v will mean that there is a sequence 
of vertices and edges of the form 

u -> «W -» ► u< ro > = v. 

The notation u ^ v will mean that u = v or u > v. The level l(u) of a vertex u 
is m if u G Z/p m Z. The valence Val(u) of a vertex u is defined as the number of 
directed edges whose end point is u. 

A subtree, or simply a tree, is defined as a nonempty subset T of vertices of U, 
such that when tieT and u > v, then v E T. Thus T together with the directed 
edges u — > v, where u, v E T , is again a tree with root {0}. 

A tree T is named a weighted tree, if there exists a weight function W : T — > N. 
The value ^(zt) is called the weight of vertex u. 

If x E Z p , and denotes its residue class modulo p l , then every vertex of U is 
of the type xi with I E N. 

A stalk is defined as a tree if having at most one vertex at each level. Thus a 
stalk is either finite, of the type 

{0}^ U «< <— «« 

or infinite, of the type 

{0} <— < . 

Clearly a finite stalk may be written as 

{0} < — x\ < — • • • < — xi, 
with x E7L, and infinite stalks as 

{0} < — x x < — x 2 < — 

with i e Z p . Thus there is a 1 — 1 correspondence between infinite stalks and 
p— adic integers. 

4.1. Tree Attached to a Polynomial. Let 

r 

(4.1) /(x) = ao []( a ;-^) e ' eQ[i] 

i=l 

be a non-constant polynomial, in one variable, of degree df, such that v p {pn) ^ 0, 
z = 1, 2, • • ■, r. We associate to /(x) and a prime number p the integer 



1 + max{f p (ai — aj) \i ^ j, 1 < i, j < f}, if r ^ 2; 

1, if r = 1. 



We set 



cti = a .i + ai.i p H h aj,j p J H h a; />i mod p 1 



+i 



G {0, 1, • • -,p — 1}, j = 0, 1, • • ■, If, i = 1, 2, • • -, r, for the p— adic expansion 
modulo p lf+1 of a». We attach a weighted tree T(f, If) to / as follows: 

r 

(4-2) T(f,l f ,p)=T(f,lf) = \jK(a i ,lf), 
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where K(a.i,lf) denotes the stalk corresponding to the p— adic expansion of on 
modulo p l ' +1 . Thus T(f, l f ) is a rooted tree. We introduce a weight function on 
T(f, If), by defining the weight of a vertex u of level m as 

(4.3) W(u) = < {»|cn=u mod?™} 

[ 0, if m = 0. 

Given a vertex it G T(/, Z/), we define the stalk generated by u to be 
B u = {v£T(f,l f ) \u^v}. 
We associate a weight W*(.B U ) to B u as follows: 

(4.4) VT(B U ) = W ( y )- 

veB u 

4.2. Computation of Trees Attached to Polynomials. Our n ext step is to 
show that a tree T(f,lf) attached to a polynomial f(x), of type (4.1), can be 
computed in polynomial time. There are well known programming techniques to 
construct and manipulate trees and forests (see e.g. j| Volume 1]), for this reason, 
we shall focus on showing that such computations can be carry out in polynomial 
time, and set aside the implementation details of a particular algorithm for this 
task. We shall include in the computation of T(f,lf), the computation of the 
weights of the stalks generated by its vertices; because all these data will be used 
in the computation of the local zeta function of /. 

Proposition 4.1. The computation of a tree T(f,lf) attached to a polynomial 
f(x), of type j^. from the p~adic expansions modulo p lf+1 of its roots 

oh = ao,i +ox,i ?H Vai s aP lf mod p lf+1 

and multiplicities e, L , i = 1, 2, r, involves 0(1, j df) arithmetic operations on 
integers with binary length 

0(max{logp, log(Z/d/)}). 
Proof. We assume that T(f, If) is finite set of the form 

(4.5) T = {Level , • • • ,Levelj, • • • ,Leveb, + i}, 

where Level,- represents the set of all vertices with level j. Each Level j is a set of 
the form 

Levelj — {ztj.i, • • •, Uji, • • •, Uj^mjj^ 

and each Uj^ is a weighted vertex for every i = 1,- • -,mj. A weighted vertex v,j t i 
is a set of the form 

u jti = { W(u jti ), Val(u 3 , t ),W*(B Ujt )}, 

where W(uj^) is the weight of Uji, Val(uj t i) is its valence, and W*(B U i) is the 
weight of stalk B Uj i . The weight of the stalk generated by Uj t i can be written as 

W*(B U] ^)= W ( v )- 

For the computation of a vertex Ujj of level j, we proceed as follows. We put 
I = {1,2, • • -,r}, and 

Mj = {a>i mod p 3 \ i £ I}. 
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For each < j < If + 1, we compute a partition of I of type 

h 

(4-6) I=\J^ 
such that 



i=l 



a t mod p° — a s mod p 3 , 

for every i,s 6 Ijj. Each subset Ij i corresponds to a vertex Ujj of level j. This 
computation requires 0(7/r 2 ) arithmetic operations on integers with binary length 
0(\ogp). Indeed, the cost of computing a "yes or no" answer for the question: a t 
mod p 3 — a s mod p 3 l is 0(j) comparisons of integers with binary length O(l ogp) . 



In the worst case, there are r vectors Mj, and the computation of partition (4.6), 
for a fixed j, involves the comparison of a t with a; for I = t + 1, t + 2, • • •, r. This 
computation requires 0(jr 2 ) arithmetic operations on integers with binary length 
Oilogp). Since j ^ // + 1, the computation of partition ([D]) requires 0(lfr 2 ) 
arithmetic operations on integers with binary length 0(\ogp). 
The weight of the vertex Ujj is given by the expression 

W ( u j,i) = X! efc - 

Thus the computation of the weight of a vertex requires 0(r) additions of integers 
with binary length 0(log<i^r). 

For the computation of the valence of Uj^, we proceed as follows. The valence 
of Uj t i can be expressed as 

Val(u jti ) = Ca,rd{I j+u | I j+U C I jti }, 

where Ij+i i runs through all possible sets that correspond to the vertices Uj+xj, 
with level j + 1. Thus the computation of Val(uj^ m ) involves the computation of a 
"yes or no" answer for the question Ij+u C The computation of a "yes or no" 
answer involves 0(r) comparisons of integers with binary length O(logr). There- 
fore the computation of Val(uj t i) involves 0{r) comparisons and 0(r) additions of 
integers with binary length O(logr). 

For the computation of the weight of B Uj ( , we observe that W* (B Uj i ) is given 
by the formula 



1=0 lj,i=h,k 

where W(I^k) = W(vi t k), and vi t k is the vertex corresponding to I^k- Thus the 
computation of W*(B U i ) involves 0(lf) additions of integers with binary length 
(3(log(7/ df)), and 0(1 / r) comparisons of integers with binary length O(logr). 

From the above reasoning follows that the computation of a vertex of a tree 
T(f,lf) involves at most 0(lf r 2 ) arithmetic operations (additions and compar- 
isons) on integers with binary length 0(max{logp, log( If df)}). Finally, since the 
number of vertices of T(f,lf) is at most 0(lf df), it follows that the computation 
of a tree of type T(f,lf) involves 0(1^ d 3 j:) arithmetic operations on integers with 
binary length 0(max{logp, log( If df)}). | 
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5. Generating Functions and Trees 



In this section we attach to a weighted tree T(/, If) and a prime p a generating 
function G(s,T(f,l f ),p) G Q(p~ s ) defined as follows. 
We set 



M 



nut) 



ueT(fJf) 



W{u) = 1, and there no exists v € T(f,lf) 
with W(v) = 1, such that u > v. 



and 



L u (p~ 



(i %-p-i-^.r u) ' ' if w = 1 + and = 2; 

p- x (p- V'aZ(u)> _i(u)_wr * (13u)s , if ^ Z(u) ^ //, and ^ 1; 

if ueM T ( f j f y, 



(i-p~> 



1 ■!„-'(«)-»'* (i 



0, if W(u) = I, and u£ M T (f,i f )- 

With all the above notation, we define the generating function attached to 
T(f,lf) and p as 

(5.1) G(s,T(f,lf),p) = L uiv- S )- 

ueT(f,i f ) 

Our next goal is to show that G(s,T(f, lf),p) = Z(s, /). The proof of this fact 
requires the following preliminary result. 

Proposition 5.1. The generating function attached to a tree T(f,lf) and a prime 
p satisfies 

G(s,T(f,l f ),p) = P-^G)+S(7) (1 ~^1C S ^ 



(5.2) 



YtP-^GMfclf-l^p). 



Proof. Let A f = {u e T(f,l f ) \ l(u) = 1, W(u) = 1}, and B f = {u e T(f,l f ) 
l(u) = 1, ^ 2}. We have the following partition for T(f,l f ) : 



(5.3) 
with 



T(f,lf) = {0}\jAf\J\ |J T u 



. ueBf 



T u = {veT(f,lf)\v^u}. 



Each T„ is a rooted tree with root {u}. From partition (5.3) and the definition of 
G(s,T(f,lf),p), it follows that 

G(s,T(f,l f ),p) = p- 1 (p - Val({0})) + Caxd{A f } (1 ft + 

(5.4) £ G( S ,T U ), 
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with G(s,T u ) = £ L V ( P - S ). 

•uGT„ 

Since there exists a bijective correspondence between the roots of f(x) = mod 
p and the vertices of T(f,lf) with level 1, 

(5.5) p - Val({0}) = i/(7), and Card{4/} = 5(f). 
Now, if the vertex u corresponds to the root /(£) = mod p, then 

(5.6) T u =l (J tf(cM/)J \{0}. 

\ {a-i | mod p} J 

On the other hand, we have that 

(5.7) T{U,l f -l)= (J K (^,l f -l). 

{ai\oti=£ mod p} 

Now we remark that the map ctj — * a< ~^ induces a isomorphism between the trees 
T u and i/ — 1), that preserves the weights of the vertices; and thus we may 

suppose that T u — T(fe, It — 1). The level function It of T(fe, If — 1) is related to 
the level function It u of T u by means of the equality It —It u = — 1- In addition, 
Bf = S, where 5 1 is the subset of {0, 1, • ■ -,p — 1} C Z p whose reduction modulo 
pZ p is equal to the set of roots of /(£) = with multiplicity greater or equal than 
two. Therefore, it holds that 

(5.8) G(s, T u ) = p- l -*'G(a, T(f c ,l f - l),p). 



The result follows from (5.4) by the identities (|5.5|) and (5 



Lemma 5.1. Let p be a fixed prime number and v p the corresponding p—adic val- 
uation, and 

r 

f(x) = a Y[(x - ai) e * e Q[x] \ Q, 

i=l 

a polynomial such that v p (ai) ^ 0, for i = 1, • • ■ , r. Then 

Z(sJ) = G(s,T(f,l f ),p). 

Proof. We proceed by induction on If. 
Case If = 1 

If r = 1 the proof follows immediately, thus we may assume that r ^ 2. Since 
If = 1, it holds that v p (cti — ctj) = 0, for every i, j, satisfying i ^ j, and thus 
Wi ^ a], if i j. By applying SPF, we have that 

(5.9) Z(s, f) = p-^Cf) + *(7) ^^ + E^' d-;-^.) . 

where each = e 3 ^ 2, for some j, and otj = £ + p/3j. 

On the other hand, T(f,lf) is a rooted tree with r vertices Vj, satisfying 
l(vj) = 1, and W(vj) = ej, for j = 1, • ■ • , r. These observations allow one to 
deduce that Z(s,f) = G(s,T(f,l/),p). 

By induction hypothesis, we may assume that Z{s,f) = G(s,T(f,lf),p), for 
every polynomial / satisfying both the hypothesis of the lemma, and the condition 
1 ^ l f ^ k, k e N. 



12 



W. A. ZUNIGA-GALINDO 



Case If =k + l, k GN 

Let f(x) be a polynomial satisfying the lemma's hypothesis, and If = k+ 1, 
^ 1. By applying SPF, we obtain that 

(5.io) z(s,f)=p- 1 v(J) + 5(T) { \~ p ~' ) _ p 1 _ 1 - + X>- 1 -* a / | / e (x) i; 

Now, since i/, = If — 1, for ev ery £ 6 S 1 , it follows from the induction hypothesis 



applied to each /g(a;) in ( |5.10| ), that 
(5.11) 

z( S , /) = p-^Q) + ^(7) ( V!"- ) L s 1 r + e^- 1 -^^, T (/?> z / - !)- p)- 



Finally, from identity (5.2), and (|5.1l| ), we conclude that 



(5.12) Z(sJ) = G( S ,T(f,l f ),p). 

I 

The following proposition gives a complexity estimate for the computation of 
G(s,T(f,l f ),p). 

Proposition 5.2. The computation of the generating function 

G(s,T(f,l f ),p) 

fromT(f,lf), involves 0(lf df) arithmetic operations on integers with binary length 
0(max{logp, log( If df)}). 



Proof. This is a consequence of proposition 4.1, and the definition of generating 
function. | 

6. Computation of p-adic Expansions 

In this section we estimate the complexity of the steps 2 and 3 in the algorithm 
Compute_ij(s, /). 

Proposition 6.1. Let 

B = max { | Cj.i | , | dj,i \ \ ctj - at = j 2 ^, cj.i, dj.i eZ\ {0}}. 

The computation of the integer If involves 0(d 2 ) arithmetic operations on 
integers with binary length 0(max{log_B, logp}). 

Proof. First, we observe that for c s Z \ {0}, the computation of v p (c) involves 
0( \°gp ) divisions of integers of binary length (9(max{log | c |, logp}). Thus the 
computation of i> P (§) = v p {c) — v p (d), involves O( max ^ lo f]g p lQ gl d l} ) divisions and 
subtractions of integers with binary length 

0(max{log | c |, log | d |,logp}). 

From these observations follow that the computation of v p (ctj — cti), i ^ j, 1 < i, 
j < r, involves 0(r 2 ) arithmetic operations on integers with binary length 
0(max{logi?, logp}). Finally, the computation of the maximum of the v p (aj — 
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a i): i 7^ i ? 1 < h j < r i involves O(logr) comparisons of integers with bi- 
nary length 0(max{log£?, logp}). Therefore the computation of the integer If 
involves at most 0(cPj ) arithmetic operations on integers with binary length 
0(max{logi?, logp}). | 

Proposition 6.2. Let p be a fixed prime and 7 = f € Q, with c,b 6 Z \ {0}, and 
v p{j) = 0- Thep—adic expansion 

7 = a + a x p H h Oj-p 7 ' H h a m p m , 

modulo p m+l involves 0(m + log(max{| 6 |, p})) arithmetic operations on integers 
with binary length 0(max{log | c | , log | b |,logp}). 

Proof. Let y £ {1, • ■ ■ ,p — ljbean integer such that yb = 1 mod p. This integer 
can be computed by means of the Euclidean algorithm in 0(log(max{| b \,p})) 
arithmetic operations involving integers of binary length 0(max{log | b |,logp}) 
(cf. H Volume 2, section 4.5.2]). 

We set 7 = 7o = f > cq = c, and define ao = yc mod p. With this notation, the 
p— adic digits aj, i = 1,- • • , m, can be computed recursively as follows: 

(cj_i— qj_ifc) 

p _ 

ll = b = T' 

di = yci mod p. 

Thus the computation of the p— adic expansion of 7 needs 0(m+log(max{| b \ ,p})) 
arithmetic operations on integers with binary length 

0(max{log I c I, log | b \, logp}). 

I 

Corollary 6.1. Let p be a fixed prime number and v p the corresponding p—adic 
valuation, and 

r 

/(s) = a H(x - ai ) e * eQ[x], 

8=1 

a non-constant polynomial such that v p (c<i) ^ 0, i = 1, • • • , r. The computation of 
thep—adic expansions modulo p lf+1 of the roots oti, i = 1,2, ••• ,r, of f(x) involves 
0(df lf + df log(max{_B,p})) arithmetic operations on integers with binary length 
0(max{log-B, logp}). 

Proof. The corollary follows directly from the two previous propositions. | 

7. Computing local zeta functions of polynomials with splitting Q 

In this section we prove the correctness of the algorithm Compute_Z(s, /) and 
estimate its complexity. 

Theorem 7.1. The algorithm Compute-Z(s, f) outputs the meromorphic contin- 
uation of the Igusa local zeta function Z(s, f) of a polynomial f{x) £ Z[x], in one 
variable, with splitting field Q. The number of arithmetic operations needed by the 
algorithm is 

O (4 + 4 log(n / 11) + l)d) + 4 log (max{B, p})) , 
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and the integers on which these operations are performed have a binary length 

O (max{logp 7 loglfdf, logB, d) + d) log(n / n)}) . 
Proof. By remark (|3.l|), we may assume without loss of generality that 



f(x) = a ]l(x - ai ) ei G Q[x] \ Q, 
i=l 

with Vp(a.i) ^ 0, i = 1, • • • , r. The correctness of the algorithm follows from lemma 



5.1. The complexity estimates are obtained as follows: the number of arithmetic 



operations needed in the steps 2 (cf. proposition 6.1), 3 (cf. corollary 6.1), 4 (cf. 



proposition 4.1), 5 (proposition |5.2j), and 6 is at most 

O (ijdj + dj log (max{B,p})) ; 
and these operations are performed on integers whose binary length is at most 

0(max{logp, logl f d f , log B}) . 

The estimates for the whole algorithm follow from the above estimates and those of 
the factoring algorithm by A. K. Lenstra, H. Lenstra and L. Lovasz (see theorem 
3.6 of @). | 

8. Stream Ciphers and Poincare series 

There is a natural connection between Poincare series and stream ciphers. In 
order to explain this relation, we recall some basic facts about stream ciphers Jig ]. 
Let F p n be a finite field with p n elements, with p a prime number. For any integer 
r > and r fixed elements qi G F p n, i = 1, ■ ■ ■, r (called taps), a Linear Feedback 
Shift Register, abbreviated LFSR, of length r consists of r cells with initial contents 
{a, G F p n | i = 1, • • •, r}. For any n ^ r, if the current state is (a n _i, • • •, a n _ r ), then 
a n is determined by the linear recurrence relation 

r 

O n ^ ^ Q>n— iQi • 

t=l 

The device outputs the rightmost element a n _ r , shifts all the cells one unit right, 
and feeds a n back to the leftmost cell. 

Any configuration of the r cells forms a state of the LSFR. If q r ^ 0, the 
following polynomial q(x) G F p »»[x] of degree r appears in the analysis of LFSRs: 

q(x) = qo + q\x + ••■.+ q r x r with q = -1. 

This polynomial is called the connection polynomial. An infinite sequence A = 
{ai G F p n | i G N} has period T if for any i ^ 0, a.i + T — a%- Such a sequence 
is called periodic. If this is only true for i greater than some index i^, then the 
sequence is called eventually periodic. The following facts about an LFSR of length 
r are well-known ]l8| . 

1. There are only finitely many possible states, and the state with all the cells 
zero will produce a 0— sequence. The output sequence is eventually periodic 
and the maximal period is p nr — 1. 

oo 

2. The Poincare series g(x) — ^ atx 1 associated with the output sequence is 

i=0 

called the generating function of the sequence. It is a rational function over 
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¥ pn of the form g(x) = with L(x), R(X) G ¥ p n[x], deg(R(X)) < r. The 
output sequence is strictly periodic if and only if deg(L(X)) < deg{R{X)). 
3. There is a one-to-one correspondence between LFSRs of length r with q r ^ 
and rational functions with deg(R(X)) = r and deg(L(X)) < r. 

We set F p n (x) for the field of rational functions over F p n , and N 00 (F p ™ ) for the 
set of sequences of the form {60, • • •, b u } 7 bi G F p ™, < i < w, u G N. From the 
above considerations, it is possible to identify an LFSR with a function F u , u G N, 
defined as follows: 



(8.1) 
We set 



OO 

J2 aiX i -> {a , ■••,«„}. 

i=0 



W = {i? (i, /) I f(x) G Z[x], in one variable, with splitting field 



and N°° (Z) for the set of finite sequences of integers. Also, for each u G N, and 
a prime number p, we define 

( o 2] F u , p : H - N~(Z) 

( ' H(t,f) - {iVo(/,p),^i(/,p),---,^„(/,p)}. 

Thus the mappings F u ^ p can be seen as LFSRs, or stream ciphers, over Z. If we 
replace each N u (f,p) by its binary representation, then the F U;P are LFSRs. For 
practical purposes it is necessary that F up can be computed efficiently, i.e., in 
polynomial time. With the above notation our second result is the following. 

Theorem 8.1. For every H(t 7 f) G H, the computation of F UjP (H(t 7 /)) involves 
0(u 2 dflf) arithmetic operations, and the integers on which these operations are 
performed have binary length 

0(max{ (l f +u)logp, log(d/Z/)}). 

The proof of this theorem will be given at the end of this section. This proof 
requires some preliminary results. We set t = q~ s , and 



00 



z( S j) = z(t,f)= y Cm (f, P )t 



m— 



with c m (f,p) = vol({x G Z p I v p (f(x)) = to}). 

Proposition 8.1. Let f(x) G Z[x] \ Z be a polynomial in one variable and p a 
prime number. The following formula holds for N n (f,p): 



(8.3) N n (f,p) 



I, if n = 0; 

P n ( 1- Eci-i(/,p) , if n>l. 



Proof. The result follows by comparing the coefficient of t n of the series 

E^t" and f> t », 
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in the following equality : 



00 N (f v) 1 ' t E Cm(/ ' P)fi 



1-t 



We associate to each u G T(f, If), and j G N, a rational integer aj(u) defined as 
follows: 



(8.4) 



(p-i) 



o= if 



a 3 (u) = < 



(p-Val(u)) 



(P-I) 

Ol(t0+l+v(u) 1 



if 



if 



0. 

, 0, 



if 



for some y(u) G N; 
0^/(u)^l/, W(u) ^ 1, j = 

u e M T (f,i f ),j = W*(B u ) + y(u), 
for some y(u) G N; 

W(u) = 1, and w g M T {f,i f y, 

in other cases. 



Proposition 8.2. Let f{x) G Z[a;]\Z foe a polynomial in one variable, with splitting 
field Q, and p a prime number. The following formula holds: 



i(f,p)= £ a», i^O. 



(8.5) 



Proof. As a consequence of lemma (|5.l|), we have the following identity: 



(8.6) 
with 



(8.7) L„(t) = ^ 



z(tj)= 

ueT{f,i f ) 



f_ ,wW*(B„) 



piW+i(l-p-it)' 11 



u e M 



T(f,lf)'> 



0, if W(u) — 1, and u Mr(f,i f )- 

The result follows by comparing the coefficient of t 3 in the series Z(t, f) 
£ c m (f,p)t m , & ndZ(t,f)= £ L u (t).§ 

m=0 uBT(f,l f ) 



Proposition 8.3. Let f(x) G Z[x]\Z &e a polynomial in one variable, with splitting 
field Q, and p a prime number. 
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The computation of N n (f,p), n ^ 1, from the Cj-\{f,p), j = 1, ■ • •, n, in- 
volves 0(n) arithmetic operations on integers with binary length 0(n\ogp). 
The computation of Cj(f,p),j^.O, from Z(t, f), involves 0(dflf) arith- 
metic operations on integers with binary length 

0(max{(j + l f )logp,logp,log(d f lf)}). 

The computation of any N n (f,p), n ^ 1, from Z(t,f), involves 0{ndflf) 
arithmetic operations on integers with binary length 

0(max{(n + If) logp, \og(d f l f )}). 



Proof. (1) By fl8j) and (|3j), Cj(f,P) = ^7, v^rrij e N - In addition, 
Cj -i(/,p) =p-J+ 1 N J _ 1 (f 1 p) -p-SNjfrp). 



Thus p n Cj^i(f 1 p) G N, for j = 1, • • •, n, and rrij < n, for j = 1, • • •, n. From (B.3) 
it follows that 



3 = 1 



The above formula implies that the computation of N n (f,p), n ^ 1, from the 
Cj_i(/,p), j = 1, •••,n, involves 0(n) arithmetic operations on integers with 
binary length 0(n\ogp). 



2) The computation of aj(u) from L u (t) (i.e. from Z(t,f), cf. (8.6)) in- 



volves 0(1) arithmetic operations (cf. (8.4), (p. 7])) on integers of binary length 



(9(max{logp, log(d///)}). Indeed, since the numbers l(u), W*{B U ), W(u), u G 



T(f,lf) are involved in this computation, we know by proposition 4.1 that their 
binary length is bounded by 0(max{logp, \og(dfl f)}). 

The cost of computing Cj(f,p) from L u (t), u G T(f,lf) (i.e. from Z(t,f)) is 
bounded by the number of vertices of T{f,lf) multiplied by an upper bound for 
the cost of computing aj(u) from L u (t), for any j, and u (cf. ( |S.5| )). Therefore, 
from the previous discussion the cost of computing Cj{f ,p) from Z{t, f) is bounded 
by 0{df If) arithmetic operations. These arithmetic operations are performed 
on integers of binary length bounded by 0(max{(j + If) \ogp, logp, \og(dflf)}). 
Indeed, the binary lengths of the numerator and the denominator of aj(u) + aj(u ), 
u, u G T(f,lf) are bounded by (// + 1 + j)\ogp (cf. (8^)). Thus, the mentioned 
arithmetic operations for calculating Cj(f,p) from L u (t) are performed on integers 
whose binary length is bounded by 0(max{(j + //) logp, logp, log(dflf)}). 

(3) The third part follows the first and second parts by (|8.8|). | 



.1. Proof of Theorem 8.1. The theorem follows from proposition 8.3 (3) 
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